Interception Act now in effect

LoneGunman said:
DFantom - its fairly standard knowledge that NSA backdoors are built into a wide range of software, especially the so-called 'encryption' technologies.
Just use TrueCrypt. It's open source so you can examine the code all you want for backdoors (and compile it yourself if you think the binaries might have been compiled from a different source).

AFAIK Serpent and AES encryption is the best. If you're really paranoid just use multiple layers of them ie. Serpent on AES on Blowfish.
 
mc721221 said:
mbs - are you still such a "big brother" supporter?

http://www.mybroadband.co.za/vb/showthread.php?t=15694
You misread my viewpoint - I am not a 'big brother' supporter (neither in the Orwellian sense nor the stupid reality show), and never will be. However, I am against the sort of paranoia and alarmist stance adopted by many concerning the issue of privacy/encryption, such as that evidenced in the postings to this thread and the one you've referenced.

The legislation concerned is designed to promote societal governance, and has an integral set of checks and balances to preclude abuse by the state. Why is that so sinister? I see it as a perfectly justifiable mechanism to promote and facilitate the tracking and tracing of illegal activities, and even more so in the light of the fact that the legislation came about through an exhaustive consultative process, not through the dictates of a few. Far better that we focus on more pertinent issues, methinx, such as the abuse and blatant profiteering of Telkrap.
 
w1z4rd said:
Rubbish noone.. all the criminals will do (and are most likely doing), is use encyption, or a webmail account. This will do fkall to combat real crime and to think otherwise is extremely naive.

Its not that I have something to hide, its that I have a problem with someone I dont know having accces to my personal infromation. for the record, i have already installed PGP and will be using it a lot more now. I recommend everyone else does the same.

,,, now heres a question.. a couple of my mail servers are in the states.... so they dont fall under this law right? As all the software and hardware is located in the states....

yup and in 1994 people were stock piling canned food, lanterns and what not because of the ANC coming into power... riiiiight.

Like RichardP pointed out, email and sms can now be used as evidence in a court of law. Which means if they intercept a coke deal going through email or smsing, they're now allowed to move in on the people involved.

Sure, they can use encryption, but not all criminals are geniuses. heck, thats why they get caught in the first place.

I know you probably don't have anything to hide, but being paranoid about someone having your personal information?

Your banks have it, and share it quite generously to anyone who pays them for it. Hell, any competition you've ever filled in has it. Even http://co.za/cgi-bin/whois.sh?Domain=antitrust might have it.

I could go on and on about how much personal information about you there already is out in this world. Encrypting the few emails you do send out or wiping your internet trail won't really matter.

I might be naive. But as far as I know (which many could contest isn't very far :D ) the authorities would first have to get a court order to snoop through your mail.

All they're doing is making the ISP's comply with standard hardware or what not so, when the time comes, they can tap into it and bob is your uncles auntie twice removed. Less hassle, because the ISP has to comply with this law. Beforehand, they'd have to give head to every person in the damn ISP just to get them to hand over some sensitive information, and even THEN it wasn't even considered evidence by the courts.

As for if the server is in the states etc. If the South African government believed you to be a criminal and wishes to monitor your email, all they have to do is contact the relevant authorities in the states and ask them for assistance in the matter. Remember, they already run systems like that ;)
 
heh heh... i somehow doubt the state wants to check everyone's email... can you imagine the man & machine power required for that...

but interesting development... would be interesting to see when they do utilise it.
 
noone - it's more than just "All they're doing is making the ISP's comply with standard hardware"

They want the ISP's to foot the bill for the equipment and leased lines etc!
 
mc721221 said:
noone - it's more than just "All they're doing is making the ISP's comply with standard hardware"

They want the ISP's to foot the bill for the equipment and leased lines etc!

they're cheap bastards, we all knew that...
 
I don't know what the fuss is all about. The US goverment fought and lost this battle back in the 90's. The first international version of PGP with strong crypto support (128 bit and up) really doomed any US legislation and made the US regulators look like fools. US domestic bussinesses were the big losers in this fight, cause for years they couldn't export strong cypto. Osama & friends could happily encrypt their plans to take over the world with "weapons grade" crypto and steganography, while commercial banks were stuck with 40 bit RC4.

LoneGunman said:
DFantom - its fairly standard knowledge that NSA backdoors are built into a wide range of software, especially the so-called 'encryption' technologies.

If you think this is conspiracy theory, then you don't know much about intelligence work, or PC security

Well, if you think Microsoft and Lotus Notes are "so-called" serious crypto I'm not so sure you know much about PC security either, nor intelligence....Ever heard of a little thing called opensource? You can search to your hearts content for those "backdoors" in the source, but you won't find any. Thousands of crypto experts from around the world (goverment and commercial) analize the source. The bigger threat here is flawed implementations in commercial crypto packages. Super-duper high bit keys won't help you if the keys are left hanging around your harddrive swapfile. If the NSA or NIA wants to read your mail, this is where they'll start.

And as for TEMPEST. Bah! My next project is going to be to build an "Enemy of the State" type Faraday cage in my room. I'm sure Mum will understand! Wonder what one of those homemade coil EMP guns will do to a sensitive TEMPEST listening post...Then again, I'm still waiting for those SABC trucks to come looking for my pirate television set with their remote TV sensing equipment.

Anyway, back to reality. If our goverment thinks they will succeed where other, vastly more competent goverments have failed they are mistaken. They can install their court ordered taps all they want, but if I use SSH, PGP, SMIME and OpenVPN they will be dissapointed. Granted, the average citizen/criminal don't know how to use these tools. Bottom line, you can be as private as you want to be!
 
Staying in reality, I recall reading on Cryptome a long time back, a series of local Military Intelligence emails from local agents and police looking to not only purchase copies of DIRT (a basic arb trojan) for use on locals PC's - but also their emails mentioning the hunting of cool little electronic guns, to disrupt PC networks (presumably ahead of a raid, to stop the deletion of materials on multiple computers)

Your Faraday cage is meaningless - as anyone can intercept the electromagnetic radiation being picked up via the nearby telephone and its cord, coming out of the cage, (or the electrical wiring in the walls nearby).

(Unless you have some great way of accessing the internet from within a sealed Faraday cage, with no cords of any kind, and no electromagnetic communications possible either, to connect you to the internet :P )

If you have some amazing non connection 'connection' technique to the Net, that involves NO radio waves, and no cords - then wooo good on you :P

But again, to the 99.8% of users, who just want to hide data from mom/dad/lovers/boss - that's easily done - it all depends what level you're operating at.
The serious classified arena has different rules, tools and behaviour to the standard materials and routine behaviours of the average civilian (including the civilian civil criminal) who thinks they and their arbitrary 'secrets' are somehow important - or that their civilian-available tools are somehow of value.

(To get a glimpse of some of the non-military low end gear used by Intelligence and law enforcement, have a look at http://www.spyzone.com/ ( I got this url from the aforementioned local Military Intelligence emails)
Bear in mind these are 'low end' gear - non classified apps. The real stuff in use will only filter down from 'black ops' current usage, in about a decade or two. Military and classified gear is roughly 20 - 30 years ahead of standard 'public' available law enforcement materials..
--------------------------EXCERPT FROM EMAIL
"HOUSE OF SECURITY

First Draft

I expect the following :

* A. Required Demonstrations.
Tempest system monitoring.
Hope software.
GSM 2060 system if 900 MHz range9 (CCS International -
<http://www.spyzone.com>) Any other computer crime related
software tools that may be available. Any other products that CCS may sell that
could be of use to my org.

B. Gather as much information and catalogues as possible on items related to
our activities.Re

1. Technical support on DIRT. Implement the Email support that was started
before Eric Schneider left. Designated support person that will get to know our
situation and problems etc.
..

(If anyones interested, I can cut n paste the entire series of emails in the off-topic thread - as I see its disappeared from Cryptome itself, luckily I saved a copy :) Its always interesting to read first person emails and communications by real intelligence operatives and Intel-gathering organisations themselves, in order to get a sense of their mindset and what they consider to be 'common knowledge' 'reality' and 'behaviour' - which shows a totally different, and usually far more complex reality than that as experienced by 'civilians' (even the tech-savvy civilians.)
 
Last edited:
oober said:
LoneGunman you sound like you have read Digital Fortress By Dan Brown :D
Oi. Stop stealing my lame jokes :D

w1z4rd said:
,,, now heres a question.. a couple of my mail servers are in the states.... so they dont fall under this law right? As all the software and hardware is located in the states....
Well this law doesn't go into it but the ECT Act of 2002 does. Now from my understanding of it (Disclaimer: I am no lawyer so I could be way off) it goes as follows:
1) If the ownership of the servers, irrespective of location, is a South African entity then those servers must comply with the law. Should those servers need to be checked the owner will be liable for the costs of either bringing the server here or sending the investigators there
2) If the server is owned by a non-South African entity and outside South Africa then it is illegal to use it unless they implement the requirements of the law and are willing to comply with SA law officals is illegal. So gmail, hotmail etc... is illegal. Hotmail had similar issues in Japan (i think) with restrictions the govt places on the internet so they setup a completely seperate infrastructure to handle Japans issues. Doubt we will get that in South Africa since our userbase is so much smaller
 
Big Brother has bveen at it for some time

I picked up a dialler virus on my laptop which I use with a dial up 56 k modem while travelling. Within a day Telkom phoned me to warn me the number beeing dialed was a well known premium rated dialer. I didn't know what was happening as the dialler would hang up the S African number, dial overseas and stay on line for a few minutes, then disconnect and reconnect to S Africa's Telkom internet access no. Damages R47-00.

Thanks to Telkom for warning me, but how did they monitor my phone line at 5 am on a Sunday morning or are they monitoring sites visited or both?

The technology must be awsome, monitoring every local call and beeing able to ascertain it's a problem when a local disconnect occurs and a dialler account is phoned. Incidently the Telkom person phoned me at my office not at my home where the offending call was made from.

It's obvious how this was done, namely using CLIPs, running a database of origonating and termination numbers and chucking out a report. A wonderfull service but what else are they matching, my home phone number and ***** Galores house of massage?
 
Top
Sign up to the MyBroadband newsletter
X